This Privacy Notification applies to the student leads / inquirers / initial application consultation of Higher Education Partners Africa (“HEPA” or “we”) consultation services.

HEPA is committed to preserving the confidentiality and integrity of all information it holds and processes and to operating its business in compliance with the requirements of the Protection of Personal Information Act, 2013 (“POPI”), and all other applicable laws relating to the processing of Personal Information (collectively, the “Legislation”).

We recognise the importance of Personal Information and of respecting the privacy rights of individuals. This Privacy Notification sets out the principles which we apply to our Processing of Personal Information so that we not only safeguard one of our most valuable assets, but also that which belongs to our partners and employees. For the most part, we process this information in one of two capacities, either:

1. as a Responsible Party for our internal business operations, such as human resources, administration, marketing, sales etc., or
2. as an Operator when carrying out our service operations for our partner’s students.

For the Protection of Personal Information Act, 2013 (the “POPI Act”), the Responsible Party is the University of the Witwatersrand, telephone: +27 11 717 1000, email: admission@wits.ac.za, website: https://www.wits.ac.za/.

It is the responsibility of all HEPA employees to apply the provisions of this notification to all Processing of Personal Information, whether HEPA is acting as Responsible Party or Operator (or both). HEPA provides employees with regular instruction concerning such matters.

Personal Information Collected and Sources of Data (if not collected from the Data Subject) [POPI Section 18(1)(a)]

Personal information collected by HEPA may include:
1. Customer Relationship Data: Information relating to identifying particulars, including first name, last name, identification number, e-mail address, physical address, telephone number, employer, the information contained in communications between us and students or their University or Employer, etc.
2. Usage data: Data about use of our website and services, which may include IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of service use.

Special Categories of Personal information collected by HEPA may include:
1. Information relating to health, including disability.

Sources of Personal information collected by HEPA may include:
Lead / Enquiry: Request for Information Form
Telephone Calls: Directly from student
Enrolment: Application Form
Cookies: Service Website

Operator’s Contact Details [POPI Section 18(1)(b)]
Website: https://higheredpartners.co.za/
Address: Unit 1, 299 Pendoring Office Park, Blackheath, Johannesburg – South Africa
E-mail address: info@higheredpartners.co.za

Responsible Party’s Contact Details [POPI Section 18(1)(b)]
Website: https://www.wits.ac.za/
Postal address: University of the Witwatersrand, 1 Jan Smuts Avenue, Braamfontein, 2000, South Africa
E-mail address: admission@wits.ac.za

The purpose for which the Information is being Collected [POPI Section 18(1)(c)]
Personal information is processed by HEPA for the following purposes
To provide our services and carry out our contractual obligations.
We process personal information in the first place to be able to offer the Services to our applicant online students and to run, maintain and develop our business. Personal information may be processed to carry out our contractual obligations towards the student. We may use the data for example to offer essential functionalities of the Services and to provide access to the Services. If a student contacts our call centre, we will use the provided information for answering questions and solving possible issues.

For student communication and marketing
We may process personal information to manage our relationships with students, communicating with students, keeping records of those communications and promoting our products and services to students.

For quality improvement and trend analysis
We may process information regarding the use of the Services to improve the quality of our Services e.g. by analysing any trends in the use of our Services. When possible, we will do this using only aggregated, non-personally identifiable data.

Keeping a proper record of transactions
We may process personal information to keep records of transactions.

Whether or not the supply of the Information by that Data Subject is Voluntary or Mandatory and the Consequences of Failure to Provide the Information [POPI section 18(1)(d) & (e)]
To use our services, there is some information which we required students to provide us either because of legal requirements or because we need that information to provide our services.

We will tell the student when the personal information requested is mandatory, or if it is voluntary. If the student does not provide mandatory personal information, we will be unable to properly provide our services.
Where a student chooses not to provide us voluntary personal information this may reduce the quality of service, we can provide (for example, if a student only provides a postal address and do not provide us with an e-mail address, we will only be able to contact the student by postal mail).

Transferring of Information to a Third Country or International Organisation and the Level of Protection Afforded [POPI section 18(1)(g)]
We primarily store personal information within the Republic of South Africa.
However, HEPA uses service providers in several geographic locations. As such, we or our service providers may transfer personal information to, or access it in, jurisdictions outside the student’s domicile.
Where we transfer your personal information outside of the Republic of South Africa, the safeguards that we will use to protect your student’s personal information include contractual obligations imposed on the recipients of the personal information. Those obligations require the recipient to protect the personal information to the standard required in the Republic of South Africa. Safeguards also include requiring the recipient to subscribe to ‘international frameworks’ intended to enable secure data sharing and where the framework is the means of protection for the personal information.

Recipient or Category of Recipients of the Information [POPI section 18(1)(h)(i) & (ii)]
Personal Information we process during the initial contact is not shared.
We may disclose a student’s personal information to our service providers who are involved in the delivery of products or services to you. We have agreements in place to ensure that they comply with the privacy requirements as required by the POPI Act. The categories of recipients that we will share your information with are:
1. our service providers, agents and sub-contractors who administer or process information on our behalf (such as our cloud service provider);
2. our partners, the University.

Our Lawful Basis for processing this Personal Information
Our lawful basis for processing your personal information is consent and contractual obligation.

Existence of the Right of Access to and the Right to Rectify the Information Collected and Objection [POPI section 18(1)(h)(iii) and (iv)]
Under the POPI Act, students have several rights. Please note that these rights are not without limitation, and in some instances may not be available. Where applicable, students have the right to:
1. request access to personal information and to obtain information about how we process it;
2. have inaccurate/incomplete personal information corrected/completed;
3. object to the processing of your personal information; and
4. have personal information erased.
To exercise these rights as set out above, students must please write to us using the details in Part B. There is no fee for making these requests. However, if a request is excessive or unfounded, we can charge a reasonable fee or refuse to comply with it.

Right to Lodge a Complaint to the Information Regulator and the Contact Details of the Information Regulator [POPI section 18(1)(h)(iii) and (iv)]
Students also have the right to complain to the information regulator if they think that we have infringed any of their rights.

Information Regulator
Contact the Information Regulator if there are any complaints about this privacy notification or information we hold. The categories of recipients that we will share your information with are:

E-mail address: inforeg@justice.gov.za
Call: Tel +27 012 406 4818
Write to them: The Information Regulator (South Africa); SALU Building, 316 Thabo Sehume Street, Pretoria
Web Address: http://www.justice.gov.za/inforeg/index.html